Debian alert DLA-4657-1 (sogo)

From:
             
 
Chris Lamb <lamby@debian.org>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 4657-1] sogo security update
Date:
             
 
Mon, 29 Jun 2026 11:30:38 -0700
Message-ID:
             
 
<178275593539.3369670.17370354410720405090@bigcat>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4657-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                           Chris Lamb
June 29, 2026                                 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : sogo
Version        : 5.8.0-2+deb12u3
CVE IDs        : CVE-2026-46445 CVE-2026-46446 CVE-2025-71276
                 CVE-2026-33550 CVE-2026-8496 CVE-2026-8851
Debian Bugs    : 1131605 1131606

Multiple vulnerabilities were discovered in sogo, the open-source
webmail and groupware server:

* CVE-2026-46445: A SQL injection vulnerability when PostgreSQL is
  used as the user database.

* CVE-2026-46446: Address a SQL injection vulnerability when MariaDB
  or PostgreSQL is used as the user database and passwords are
  stored in cleartext.

* CVE-2025-71276: Fix a A Cross-Site Scripting (XSS) vulnerability in
  events, tasks and contacts categories.

* CVE-2026-33550: Address a number of Time-Based One-Time Passwords
  (TOTP) vulnerabilities, including if a user disables/enables TOTP,
  various values not being renewed, and an issue around recommended
  TOTP lengths.

* CVE-2026-8496: Fix an issue where a maliciously crafted .ICS
  calendar invitation file allowed arbitrary JavaScript execution
  within an authenticated webmail session.

* CVE-2026-8851: Fix an SQL injection vulnerability in the access
  control list management functionality, which could have allowed
  authenticated users to extract arbitrary data from the database by
  injecting SQL subqueries through the "uid" parameter of the
  "addUserInAcls" endpoint.

In addition, a patch was added to fix a Cross-Site Scripting (XSS)
vulnerability in message subject rendering.

For Debian 11 bullseye, these problem have been fixed in version
5.8.0-2+deb12u3.

We recommend that you upgrade your sogo packages.

Thank you to Peter Wienemann <wiene@debian.org> for preparing this
update.

For the detailed security status of sogo please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/sogo

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEwv5L0nHBObhsUz5GHpU+J9QxHlgFAmpCsl0ACgkQHpU+J9Qx
Hli8sQ//YcMloOPhokVH0p5FBXS3Rd5fYvup7Ec8f6ha0CGXT3Fr74LfHTaoOzNN
cETfnpSBfyzSK5aBZbL2/gKiihMuX4IORFYNt5UuQA4TvkwPTG6rwikGbUlC5oMi
7rwm6cbqaInABe940pwSmkpysV2yzAAod0G7twaX4EYPOma2/l8iGzTJ2t5gVnO+
35rgBZUs4VVdMPusoUhuauyUpC1QlS2ag0znSt2BLENRn0Bb3qWVR51VJ52/rSmF
6agipAue/LJPqreKKyFreYm9M6c6jAeIi8WT9Tj3R9dcXvxc91cQSCk6jSPaNs98
CVsPw4bcLVOXLpwsTBD4kkLwOXzB8S5UMNkrbPyCwQF6l7RezjYpNmMEcnt5jpMM
qhBWTktzyk7i32/VFv5Bk/n1Upt13KelivZiWZjjyWUgqgxmRrSobB9Cq1ZWJB1X
COsYVHZ13FStq+R3+0CYueu/oxQuEUFM0xT0NnrKXjUrCLU2q65LOBmcdQ5CDvyu
8UcJgKJv7hTfrf/kfD8qyWsQ4EvSEvWi+yOOYyKztLokpNxhTgqjca2VdVpz10pF
aRupsCO/cBdo7tHvGehMvK9kf98ye9suv5WwJ+QLZX5quGuvVIrib1I26GbvOp+H
C/eBD8g5esQ4qCX7T/nwsydVcWF2pMpW9AyTAlxNVgXuYp2O264=
=5DLS
-----END PGP SIGNATURE-----